Official Claude Code extension on Cursor Marketplace caught with SSH backdoor

What Phorion found

Security firm Phorion published a technical report describing a backdoor embedded in the official Claude Code for VS Code extension, distributed through Cursor Marketplace. It's worth stressing the distinction: Cursor is an editor derived from VS Code, with its own marketplace, separate from the official store maintained by Microsoft. The compromised package circulated specifically there.

According to the October 31, 2026 update on the post itself, Cursor's security advisory came to identify two affected versions: 2.1.312 and 2.1.313, for macOS and Windows. Phorion's original publication had pointed to only 2.1.313; the list was expanded later. Cursor has already removed both packages from the marketplace.

The extension.js file in the compromised bundle had a self-executing function (IIFE) injected before the extension's normal code. It imports native Node modules (child_process, fs, os, path, http, crypto) and runs as soon as Node loads the file, even before the original extension's activate() callback fires. In other words: the user doesn't need to click anything, or open any Claude Code command, for the payload to execute.

How the attack works, step by step

Phorion's report reconstructs the full chain in four stages:

1. Planted SSH key: the script ensures ~/.ssh exists and appends an attacker-controlled Ed25519 public key to ~/.ssh/authorized_keys, with the comment svc-telemetry. It checks for the presence of the comment, not the key itself, which is why Phorion recommends hunting by the key's fingerprint (SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk), not by the text string.
2. Reverse SSH tunnel: using a second embedded private key (comment svc-telemetry-tun), the malware opens an outbound SSH connection to 134.209.82.225:22, with -R *:0:localhost:22. This asks the attacker's server for a dynamically allocated port that forwards traffic back to port 22 on the victim's machine.
3. Persistence: on macOS, it writes a LaunchAgent disguised as com.apple.sysmond.plist in ~/Library/LaunchAgents/, which runs /bin/sh ~/.config/.smt with RunAtLoad and KeepAlive enabled. On Linux, it uses an @reboot entry in the user's crontab. On Windows, it tries to create a scheduled task running as SYSTEM and, if that fails, falls back to a .cmd file in the user's Startup folder.
4. Reconnaissance beacon: collects hostname, user, OS, home directory, the email from git config --global user.email, public IP (via ifconfig.me or api.ipify.org), and up to 40 environment variable names matching the pattern /KEY|TOKEN|SECRET|PASS|AWS|GCP/i, names only, not values. The JSON package is sent via POST /beacon in plain text to 134.209.82.225:8099.

With the key planted and the tunnel active, the operator only needs to open a second SSH connection to the port allocated on their own server to gain an interactive shell on the victim's machine, authenticated with the svc-telemetry key.

The bug that leaves macOS partially protected

The most interesting part of the report is a logic error that reduces the impact on macOS. The script tries to check the state of Remote Login (SSH) by running systemsetup -getremotelogin without elevated privileges, and only tries to turn SSH on if the output contains the word Off. The problem is that, without administrator permission, this command prints an error and exits with status 0:

You need administrator access to run this tool... exiting!

Since this string doesn't contain Off, the test /Off/i.test(rl) fails, and the malware never gets to try sudo -n systemsetup -setremotelogin on. Phorion summarizes the problem this way:

In practice, the malware treats the phrase